T1003.006 — DCSync

Tactic: Credential Access · Platforms: Windows

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain…

Sub-technique of OS Credential Dumping (T1003).

Sigma detection rules (1)

T1003.006 OS Credential Dumping: DCSync

title: "T1003.006 OS Credential Dumping: DCSync"
id: b2c1b64e-f64d-462a-87b3-de71b5eba606
description: 'Detection of Unauthorized DCSync Operations via Replication API Abuse. (Data Component: Active Directory Object Access; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, SourceIP.'
references:
  - https://attack.mitre.org/techniques/T1003/006
author: Shahrukh Khan
date: 2026-02-16
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.006

logsource:
  product: windows
  service: security

detection:
  selection_eventid:
    EventID: '4662'

  selection_replication_rights:
    Properties|contains:
      - '{1131f6aa-9c07-11d1-f79f-00c04fc2dcd2}'
      - '{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}'
      - '{89e95b76-444d-4c62-991a-0facbeda640c}'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_eventid and selection_replication_rights and not filter_system_account

falsepositives:
  - Domain controllers replicating with each other and authorized replication accounts (e.g. Azure AD Connect, backup/DR tooling) legitimately request DS-Replication-Get-Changes/-All rights; allowlist known replication service accounts and source IPs. System and service accounts are excluded via filter_system_account.

level: medium

Related sub-techniques

Explore